```markdown
## Extending Evidence

**Source:** Theseus synthetic analysis

The 29-78% AUROC improvement is a a clean-data accuracy result. Nordby et al. did not test adversarial robustness. Under white-box adversarial conditions (open-weights models), multi-layer ensembles are predicted to provide no structural protection against SCAV-generalization attacks. This improvement applies only to non-adversarial monitoring contexts.
```